On 21 October 2026 the PHP project shipped emergency fixes for two critical flaws that can let an attacker run their own code on a web server without logging in. PHP is the language WordPress runs on, so this reaches a very large number of business websites. If Results You Can Measure hosts your website, you do not need to take any action yourself. Getting the fixed version running, and keeping the other defences in place while it rolls out, is our job.
What did PHP announce on 21 October 2026?
The PHP project gave a day’s notice on 20 October that an emergency security release was coming, then published it on 21 October. It fixes two flaws, both rated 9.2 under CVSS v4.0, the scale the industry uses to score severity.
- CVE-2026-109618: when PHP runs out of memory part-way through a request, it can be left holding half-built internal data that its clean-up code then trusts. An attacker can force this with oversized or deeply nested form uploads, and PHP’s own testing showed code execution on a common server setup before any website code had run.
- CVE-2026-109619: data belonging to one visitor’s request can linger in a PHP worker after it should have been cleared, where a later request can reach it. One confirmed route uses PHP’s upload-progress feature.
The detail that matters for a business owner is where these flaws live. They are in PHP itself, not in WordPress or a plugin. A WordPress site with every plugin up to date is still exposed until the server runs a fixed release. The PHP project’s own advisory puts it plainly: “There are no complete mitigations, updating is the only safe choice.”
Which PHP versions are fixed?
Every PHP version that still receives security support got a fixed release on 21 October. Anything older did not.
| PHP version | Fixed release | Security support ends |
|---|---|---|
| 8.5 | 8.5.12 | 31 December 2029 |
| 8.4 | 8.4.27 | 31 December 2028 |
| 8.3 | 8.3.36 | 31 December 2027 |
| 8.2 | 8.2.35 | 31 December 2026 |
| 8.1 | No fix | Ended 31 December 2025 |
| 7.4 | No fix | Ended 28 November 2022 |
Dates are from the PHP project’s supported versions and end of life pages.
Two things stand out. PHP 8.2 has ten weeks of security support left, so a site on 8.2 needs a planned move this year even after taking today’s fix. And PHP 7.4, still common on older WordPress sites, has had no security fixes for nearly four years. A flaw like this one stays open on it permanently.
How fast do attackers move once a flaw is published?
Faster than any person can patch. Patchstack’s State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% rise on 2024. Plugins accounted for 91% of them and themes for 9%, with only six found in WordPress core.
Two of Patchstack’s figures explain why a single line of defence is never enough:
- 46% of vulnerabilities had no fix from the developer by the time they were made public.
- 5 hours was the median time from disclosure to mass exploitation for the most heavily exploited flaws, and around half of high-impact flaws were exploited within 24 hours.
Nobody is choosing your website by hand. Automated scanners sweep the internet looking for a known version number or a known weak plugin, and they treat a ten-page brochure site exactly like a national retailer. That is why Results You Can Measure builds protection in layers: when the patch is hours away, or does not exist yet, something else has to hold the line.
How does Results You Can Measure respond when a new flaw lands?
Today’s PHP release is a useful worked example, because it tested every layer in a single afternoon.
- The edge acts first. The content delivery network in front of the WordPress sites we host had a managed firewall rule targeting the upload-progress route ready before PHP’s fix was even published, and added rules for deeply nested uploads within fifteen minutes of the release. Rules like these buy time. They are not the fix, and PHP says so.
- We check which sites are affected. Results You Can Measure checks the PHP version of every WordPress site we host, so we know immediately which sites the fixed release covers and which sit on a branch that will never get one.
- The fixed release goes on. The patched PHP build is applied at server level, followed by a check that each site still loads normally.
- Older versions get a plan. Sites on an end-of-life branch are moved up using the safe upgrade process described below, or, where the site cannot run on a supported version, the owner is told what is at risk and what it would take to fix.
- You hear from us if anything affects you. In plain English, without the jargon.
What protects a website hosted by Results You Can Measure?
Each layer stops something different, and each one covers a gap the others leave.
| Layer | What it stops | When it acts |
|---|---|---|
| Edge network (Cloudflare and our CDN) | Bad bots, traffic floods (DDoS attacks), known attack patterns, unencrypted connections | Before a request reaches the server |
| Server firewall | Port scanning, repeated login attempts, suspicious connections | On the server, before WordPress loads |
| Site firewall | Malicious form submissions, SQL injection, attempts on known plugin flaws, malware and unexpected file changes | Inside WordPress |
| Updates | Known flaws in WordPress core, plugins and themes | Several times a week |
| Safe PHP upgrades | Downtime caused by a version change | Every time PHP changes |
| Daily backups | Lost data after an incident | Stored across multiple locations |
| People | Anything the tools miss | Security advisories read as they are published |
The two firewalls are worth a note. The server firewall is a gatekeeper that knows nothing about WordPress, so it judges traffic by behaviour: too many login attempts, too many ports probed. The site firewall knows WordPress in detail, so it can spot an attack dressed up as an ordinary form submission, but it only ever sees the traffic the gatekeeper let through. Hosting runs on Google Cloud and AWS infrastructure, the same platforms banks and government services rely on.
Why do some websites break when PHP is upgraded?
Because older plugins and themes are often written for features that newer PHP versions have removed. Switch the version and the site can fall over with WordPress’s “There has been a critical error on this website” message. Sometimes a cached homepage keeps loading perfectly while every other page is broken, so the problem goes unnoticed until a customer mentions it.
This is the real reason so many websites sit on PHP versions that stopped receiving fixes years ago. The owner, or their developer, fears the upgrade more than the vulnerability. Every month the gap widens, more plugins fall behind, and the eventual upgrade gets harder.
A safe upgrade process removes that fear, and with it the excuse for staying on an unsupported version.
How does a safe PHP upgrade work?
The hosting platform behind the WordPress sites we look after treats every PHP change as a test the site has to pass:
- Check: confirm the site loads normally before anything changes.
- Switch: move the site to the new PHP version.
- Clear every cache: the page cache, the WordPress object cache, the server cache and the CDN, so nothing stale can hide a fault.
- Watch: monitor the site for a minute or two. An error page, a blank page or no response at all counts as a failure.
- Roll back if needed: on failure, switch back to the previous version automatically, clear the caches again and confirm the site has recovered.
The failure alert usually includes the error WordPress reported, which tends to name the plugin or theme that is not ready. That turns a vague “it broke” into a specific item to update before the next attempt.
Two edge cases are handled with care. A single failed check that looks like a momentary server reload is re-checked a few seconds later rather than triggering a rollback. And if a firewall blocks the check itself, the change stays in place and a person looks at the site, rather than the system guessing.
What about websites that do not run PHP at all?
Many of the websites Results You Can Measure builds today never touch PHP. We build them with Astro, which turns the whole site into finished files ahead of time, then serve those files from Cloudflare’s global network. There is no PHP on a server, no database to inject into and no plugins waiting for their next vulnerability. Today’s flaws have nothing to attach to. This website is built exactly that way.
No PHP does not mean no maintenance. Every new site we build ships with security headers as standard, including HSTS, which forces encrypted connections. A Content Security Policy, which limits what code a page may load, is tuned to each site and switched to enforcement once it has been tested in a real browser. The build itself refuses to deploy if a core dependency falls a major version behind, and a nightly automated check reads the software versions and backup status of the sites we build, so anything drifting out of date is on a list the next morning.
For a business that mainly needs a fast, clear website that wins enquiries, this is often the more secure choice as well as the faster one. Our website speed guide covers the performance side.
Does a small business get the same protection as a large one?
Yes. Results You Can Measure has no premium security tier. A sole trader’s brochure site gets the same edge network, the same firewalls, the same update routine and the same backup schedule as the largest sites we host.
The reasoning is simple. Attackers do not scale their effort to the size of the business, so protection should not either. An automated scanner probing for a vulnerable plugin cannot tell whether the site belongs to a national brand or a three-person firm in Bradford, and it does not care.
Hosting starts from £30 per month and includes ongoing maintenance and security updates several times each week. You also get something the big hosting companies rarely offer: a direct line to the people who know your site, rather than a ticket queue.
How can you check whether your own website is protected?
Work through these questions with whoever looks after your site. If an answer is “I don’t know”, that is the answer.
- Which PHP version does your site run? In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Anything below 8.2 is unsupported, and 8.2 itself ends on 31 December 2026.
- Is today’s fixed release running? Ask your host to confirm the exact version, for example 8.4.27, not just “8.4”.
- Who updates your plugins, and when did it last happen?
- What happens if a PHP upgrade breaks the site? Is there an automatic rollback, or does someone find out from a customer?
- Is there a firewall at both the server and the site level?
- When was the last backup, and has anyone ever tested restoring it?
- Who answers if something looks wrong at 7pm on a Friday?
FAQs
Is my WordPress website affected by CVE-2026-109618 and CVE-2026-109619?
Any website running PHP should be treated as exposed until it runs a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later. The flaws sit in PHP itself rather than in WordPress or any plugin, so keeping WordPress and its plugins up to date does not close them. The PHP project recommends that every user updates immediately. If Results You Can Measure hosts your website, this is handled for you and you do not need to do anything. If someone else hosts it, ask them which exact PHP version your site runs today and when the fixed release will be applied. A host that cannot answer quickly is telling you something about how it handles security.
Can a firewall protect my website without updating PHP?
Partly, and only for a while. Managed firewall rules at the edge can block the known attack routes for these flaws, such as requests that use PHP’s upload-progress field or form fields nested many levels deep. They cannot cover every possible route, and a customised application can slip past a rule written for the default settings. The PHP project states there are no complete mitigations and that updating is the only safe choice. Results You Can Measure treats a firewall rule as the thing that buys time while the fixed release goes on, never as a substitute for it.
My website is on PHP 7.4 or 8.1. What should I do?
Plan an upgrade now. Neither version receives security fixes from the PHP project, so today’s flaws, and every future one, stay open on them for good. The sensible target is PHP 8.4, supported until the end of 2028, or 8.5, supported until the end of 2029. Expect at least one old plugin or theme to need updating or replacing first. A safe upgrade process with automatic rollback means the attempt itself carries little risk: if the site fails, it returns to the previous version within a couple of minutes and the error points to the cause.
What if my website cannot run on a supported PHP version?
Some older websites rely on a plugin or theme that was abandoned years ago, and they fall over on every supported PHP version. Edge and site firewalls reduce the risk for a site like that, but they cannot remove it, because the underlying flaws will never be fixed. The real options are replacing the components that break, or rebuilding the site. Results You Can Measure tells the owner when a site is in this position, and keeps telling them, setting out what is at risk and what each option would involve and cost. The decision stays with the owner, but it is made with the facts in front of them.
Will upgrading PHP break my website?
It can, if a plugin or theme depends on something the new version has removed. That is exactly what a safe upgrade process is for. The site is checked before the change, watched after it and switched back automatically if it fails, with the error recorded so the cause can be fixed before the next attempt. Sites with current plugins and themes rarely have trouble. The ones that fail are usually the ones that have gone longest without maintenance.
Can Results You Can Measure take over hosting from another provider?
Yes. We move the site across, check it before and after the move, and put it on a supported PHP version as part of the process wherever the site can run on one. From then on it sits behind the same edge network, firewalls, updates and daily backups as every other site we host. Hosting starts from £30 per month including maintenance and security updates, and you deal directly with the people who look after your site.
Related services
- Hosting & Maintenance for managed WordPress hosting with security updates, backups and safe PHP upgrades included
- Web Development for fast Astro websites with no PHP, database or plugins to attack
Not sure where your website stands?
Security headlines like today’s are a good prompt to check. Book a call and we will look at your PHP version, how current your plugins are, your firewall cover and your backups, then tell you in plain English what we would change. If we are a good fit, we will handle the move for you.